terry@google.com | 256453d | 2015-12-18 17:55:16 | [diff] [blame] | 1 | <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> |
| 2 | <html> |
| 3 | <head> |
| 4 | <script> |
| 5 | |
| 6 | function runArrayOOMTest() { |
| 7 | document.write("<p>Starting test...</p>"); |
| 8 | |
| 9 | // The index 'target' is the location in the array we expect to fault on access, should the size calculation of the realloc of the vector be allowed |
| 10 | // to overflow. The vector needs to be ((target + 1) * sizeof(JSValue*)) bytes long to hold 'target', or approximately 2/3 UINT32_MAX. Upon growing |
| 11 | // the array an additional 50% capacity will be allocated, plus the storage object header, taking the size of the allocation over UINT32_MAX. |
| 12 | var target = Math.floor(0xFFFFFFFF / 6); |
| 13 | // In order to force arr[target] to be stored in the vector, rather than the sparse map, we need ensure the vector is sufficiently densely populated. |
| 14 | var populate = Math.floor(target / 8 + 1); |
| 15 | |
| 16 | try { |
| 17 | var arr = new Array(); |
| 18 | for (i=0; i < populate; ++i) |
| 19 | arr[i] = 0; |
| 20 | arr[target] = 0; |
| 21 | } catch(e) { |
| 22 | var expect_name = "Error"; |
| 23 | var expect_message = "Out of memory"; |
| 24 | if ((e.name == expect_name) && (e.message == expect_message)) |
| 25 | document.write("<p>SUCCESS</p>"); |
| 26 | else |
| 27 | document.write("<p>FAIL - Expected \"" + expect_name + "/" + expect_message + "\", got \"" + e.name + "/" + e.message + "\".</p>"); |
| 28 | |
| 29 | return; |
| 30 | } |
| 31 | |
| 32 | document.write("<p>FAIL - Expected exception.</p>"); |
| 33 | } |
| 34 | |
| 35 | </script> |
| 36 | </head> |
| 37 | <body> |
| 38 | <p>This test checks that Array objects fail gracefully (throw exception) when array length grows large.</p> |
| 39 | <p>This test may run for over 20 seconds on a fast machine, and will consume hundereds of MB of memory.</p> |
| 40 | <input type="button" onclick="runArrayOOMTest()" value="Start"> |
| 41 | </body> |
| 42 | </html> |